Is you Mac running hot, battery draining fast and apps running poorly? There is some new malware affecting macOS which has started to circulate. Affected macOS systems typically have their processor running at full throttle which can prevent other software from performing optimally.
As it has been recently discovered it is still unknown what exactly mshelper is doing to utilize the processor at such a high rate, but the current speculation is that it could be some form of adware, or possibly a program used for mining cryptocurrency on your Mac.
Aside from using the processor, there also doesn't seem to be any other issues it causes on affected desktops, as is typical with ransomware. As it isn't a virus, it is likely mshelper is distributed through an installation of another piece of software rather than spreading organically.
How do I know if I have it?
- Open the Activity Monitor app which can be found in the Applications folder under Utilities.
- Click the CPU tab to bring up a list of current processes, then click the Process Name column header to sort the list by alphabetical order.
- Scroll down the list until you reach where mshelper would appear alphabetically.
- If it appears at all, then the next task is to eliminate it from macOS.
I have it, should I panic now?
Not quite yet! You can kill the process from Activity Monitor, but it will just relaunch itself.
It is possible to stop this from happening by deleting two files buried in the Mac's library
- In Finder, click on the Go menu, then select Go to Folder...
- Enter /Library/ and click the Go button.
- Browse to the LaunchDaemons folder.
- Select com.pplauncher.plist and delete it.
- The other file is also found in the Library.
- Browse to Application Support.
- Select and delete pplauncher.
- Restart your Mac.
At this point you should check Activity Monitor again and if it is gone you should be good.
What happens now?
We recommend being extra careful not to download any suspicious files in the future so you can avoid whatever terrible software comes next!
Apple does operate its own anti-malware protection system, called Gatekeeper, in macOS. It designed to protect against threats known to the company just like this one. While it isn't currently protecting against this issue, it is highly probable Apple will include changes in a future update to prevent it from working.